The score-based model from [1]} and its annealed Langevin dynamics process has recently been used for purifying adversarial signals [2]}, [3]}. One approach is add noise and the using the score model to denoise [2]}. The robustness of this method is upper-bounded by standard randomized smoothing [5]}. Another approach is to initiate the Langevin process of the score model from a natural image as done in the EBM defense. A score model can be used in a langevin process \(T(x)\)  that is a direct analogue to the EBM langevin process in (REF ) and (REF ). Given a score model \(S_\theta (x)\)  for a low noise value \(\sigma \) , one can define the Langevin equation
\(X_t = {X_{t-1}} \frac{\eta ^2}{2} S_{\theta }(X_{t-1}) + \eta Z_t\) 
